[00:00.000 --> 00:04.320]  Hi, everybody. I am Muhammad Ali from Borenger Ingelheim. I lead the digital development
[00:04.320 --> 00:09.780]  group over there under ClinOps. And I'm here now today to have a fireside chat with Dr.
[00:09.780 --> 00:14.220]  Amy Abernathy, the Deputy Chief Commissioner for the FDA and the CIO. So looking forward
[00:14.220 --> 00:19.160]  to discussion with her. I'm sure she has wonderful insights, and we would love to get her perspective
[00:19.160 --> 00:26.020]  on many things here regarding biosecurity, medical devices, and the overall digital health
[00:26.020 --> 00:27.760]  space. Dr. Abernathy?
[00:28.480 --> 00:32.980]  Hi, it's great to meet you, and it's great to be here with you and talk about a pretty
[00:32.980 --> 00:35.040]  important topic from my perspective.
[00:36.560 --> 00:41.820]  Fantastic, fantastic. So now with the midst of this pandemic kind of ravaging within the
[00:41.820 --> 00:48.260]  United States and pretty much many parts of the world, there has been a huge bits of pressure
[00:48.260 --> 00:53.300]  on enhancing the digital tools and landscape of the ability of types of data that we're
[00:53.300 --> 00:58.380]  collecting on patients and population in real world. And with increased investments
[00:58.380 --> 01:03.200]  in digital health so far this year, so far hitting 9 billion just in the first half,
[01:03.200 --> 01:08.680]  which has been a record so far to date, where do we see the role of real-world evidence
[01:08.680 --> 01:13.800]  playing in really understanding what to learn about patients and the FDA's perspective around
[01:13.800 --> 01:16.880]  using real-world evidence for this reason?
[01:17.510 --> 01:25.240]  So first of all, as I think about the pandemic, if I imagine where we are right now and where
[01:25.240 --> 01:32.320]  we're going to need to be in managing this virus and the health of our population, we
[01:32.320 --> 01:41.880]  need to rapidly answer a huge swath of questions right now, which means that while the best
[01:41.880 --> 01:48.460]  way to answer critical questions is through thoughtful experimental designs like randomized
[01:48.460 --> 01:54.860]  control trials, we don't have enough clinical trial capacity or enough time to use clinical
[01:54.860 --> 01:58.940]  trials for every question sitting in front of us. And so we're going to need to leverage
[01:58.940 --> 02:04.000]  all the data sources currently available, including data sources that are classically
[02:04.000 --> 02:09.080]  called real-world data sources. These are electronic health records and claims data,
[02:09.080 --> 02:17.660]  but also include information from social media feeds or from a fitness watch. So many different
[02:17.660 --> 02:25.340]  data sources that describe a person's health, their activities, what they've experienced,
[02:25.340 --> 02:29.980]  potential adverse effects of interventions or treatments. We're going to not only need
[02:29.980 --> 02:36.320]  to learn how to use this information and put it to use for critical questions in COVID-19,
[02:36.320 --> 02:41.340]  we're going to need to understand when we can rely on it, when is it adequate and credible,
[02:41.340 --> 02:46.540]  and when do we need to now really direct our clinical trial resources to answer those
[02:46.540 --> 02:52.720]  questions where real-world data can't help us. That's very helpful. Now, you mentioned social
[02:52.720 --> 02:57.640]  media. So what would be some of the steps or examples the FDA has taken to kind of discern
[02:57.640 --> 03:01.840]  what would be a real data source on social media that will be verified versus that of, let's say,
[03:01.840 --> 03:06.960]  bot posting, that that may lead to some understanding which is not true or lead to
[03:06.960 --> 03:13.060]  an incidence for patients which could cause potential harm? So before I go to how we might
[03:13.060 --> 03:17.140]  deal with social media and bots, maybe what I'll do is back up a couple of steps to think about
[03:17.140 --> 03:24.060]  what we're learning about where real-world data might be put to task. And that will then help us
[03:24.060 --> 03:29.600]  start to address the questions that you've brought up around social media. So at FDA,
[03:29.600 --> 03:34.080]  we have been participating in a number of projects inside the agency and outside the agency
[03:35.400 --> 03:40.360]  to utilize real-world data to address our critical questions. And as we've been doing that,
[03:40.360 --> 03:45.060]  we've been learning really where we can rely on it, where do we need to do additional work
[03:45.060 --> 03:51.680]  in order to allow real-world evidence to be credible, and where can't we rely on it. And
[03:52.920 --> 03:58.780]  examples are questions such as what's the natural history of COVID-19? What are the patterns of
[03:58.780 --> 04:03.020]  treatments patients are receiving and how have those patterns changed over time? What are new
[04:03.020 --> 04:10.060]  problems we're dealing with, such as the emergence of clotting disorders or the challenges of late
[04:10.060 --> 04:17.780]  effects to the heart? And then how does that inform, for example, what treatments may have
[04:17.780 --> 04:22.260]  differing impacts, both on the safety side as well as the effectiveness of treatments,
[04:22.260 --> 04:27.920]  and how can we think about the role of diagnostics and differing performance of diagnostics? So
[04:27.920 --> 04:33.440]  those are some of the kinds of questions that real-world data is being used for. Now you asked
[04:33.440 --> 04:39.380]  specifically about social media feeds and how do we think about that? Well, practically speaking,
[04:39.380 --> 04:44.780]  you can imagine that we need to take a series of developmental steps and do this quickly. So first
[04:44.780 --> 04:49.280]  learning how to use electronic health record data more confidently, claims data, et cetera,
[04:49.280 --> 04:56.640]  and then starting to layer in new information. And an example is we have been watching some
[04:56.640 --> 05:03.700]  pretty interesting work happening with Twitter feeds and how Twitter can help to understand
[05:03.700 --> 05:10.160]  signals that people are communicating about that may deserve additional deep dive attention. So,
[05:10.160 --> 05:19.100]  for example, one of the areas that really received a lot of attention was around clotting events. And
[05:19.760 --> 05:24.700]  doctors were noticing clotting events, patients were describing challenges that sounded like
[05:24.700 --> 05:30.540]  clotting events, which then led to increased understanding that maybe clotting was a challenge
[05:30.540 --> 05:37.040]  in the context of COVID-19. And so we can use, for example, social media to help to pick up signals
[05:37.040 --> 05:41.540]  and then use other data sets to verify those signals. And that's something we're just starting
[05:41.540 --> 05:47.960]  to think about. I wouldn't call this FDA-specific work, but rather work FDA is paying close attention
[05:47.960 --> 05:55.780]  to. The third part of your question was around where might this go awry? So, for example,
[05:55.780 --> 06:02.720]  how do we need to think about the role of bots and how that may create misinformation
[06:03.480 --> 06:09.560]  that may also be one of the signals? And, you know, first of all, be attentive, right? So,
[06:09.560 --> 06:18.240]  recognize that information may be misinformation and may or may not be nefarious in how it has
[06:18.240 --> 06:28.840]  occurred. Secondly, to do the experimentation to understand what does inadequate information,
[06:28.840 --> 06:33.660]  misinformation, nefarious information look like, and be able to identify that quickly. So,
[06:33.660 --> 06:42.200]  oftentimes, bots have particular patterns that can be identified. And then also be transparent.
[06:42.200 --> 06:47.700]  I mean, one of the challenges with all these new types of data sources is that perhaps you're
[06:47.700 --> 06:52.820]  saying, well, we're interested in learning more about how social media data can help. And
[06:53.980 --> 06:59.800]  the really quick retort is, oh, but that's not reliable because dot, dot, dot, one of which is
[06:59.800 --> 07:08.040]  bots. And by being transparent that we are curious about some of these new data sources,
[07:08.040 --> 07:15.100]  but we're also attentive to the potential risks and downsides allows people to know we're paying
[07:15.100 --> 07:20.320]  attention to all the different aspects. So, this is something that's high in our mind as we start
[07:20.320 --> 07:26.500]  to think about these new types of data. That's fantastic, Danelle. You mentioned risks when it
[07:26.500 --> 07:31.580]  comes to these platforms, et cetera. Now, with the rise of digital health and many of these tech
[07:31.580 --> 07:36.920]  giants really taking a foray into healthcare. Now, having been within the clinical trial space for
[07:37.460 --> 07:41.400]  almost two decades now, one of the primary steps to get to clinical trials is really informed
[07:41.400 --> 07:45.400]  consent. Because without informed consent, you really can't get anywhere. And the informed
[07:45.400 --> 07:48.900]  consent is always for the intended use of the clinical trial that the patient's participating
[07:48.900 --> 07:54.400]  for, for the data they want to collect for in that trial. Now, with these tech giants, when you have
[07:54.400 --> 07:59.620]  wearables and devices, even your smartphone with the 11 to 15 sensors that are embedded
[07:59.620 --> 08:04.640]  within the actual phone itself, you're continuously capturing data to understand not just overall
[08:04.640 --> 08:08.840]  demographic information, but you understand behavioral patterns, you understand behavioral
[08:08.840 --> 08:14.500]  impulse control, geographic location, et cetera. What is the FDA's perspective in terms, or even
[08:14.500 --> 08:19.160]  Amy's perspective, really in this understanding what is the patient's rights in being able to
[08:19.160 --> 08:23.420]  access this data to get a better understanding of themselves and how it's being used to really
[08:23.420 --> 08:27.820]  create new services for them that they may not even want or something they can overall contribute
[08:27.820 --> 08:36.160]  to in the future? Well, so you're bringing up a really important point and focus that's near and
[08:36.160 --> 08:41.600]  dear to my heart, which is that as we have all of these new data sources, all of these new
[08:41.600 --> 08:50.820]  capabilities, we also have new challenges as it relates to privacy, a person's rights, how do we
[08:50.820 --> 08:54.840]  know that information is being used in the way that we intended? In the context of a clinical
[08:54.840 --> 09:01.000]  trial, I'm an old clinical trial myself, it was quite explicit upfront. Here's what's going to
[09:01.000 --> 09:07.000]  happen. Here's how my information is going to be used. And those controls are already put in place
[09:07.000 --> 09:14.420]  in a very explicit way. Within the context of the real world data space, when it's around health,
[09:14.420 --> 09:21.960]  we have clear laws as it relates to, for example, HIPAA. However, as you start to talk about the
[09:21.960 --> 09:29.720]  consumer space, as we start to now think about products, you mentioned the smartphone that has
[09:29.720 --> 09:35.320]  many different sensors and where information may be used in many different ways that are sort of
[09:35.320 --> 09:41.680]  outside of the traditional context of health information for HIPAA. We now are in a privacy
[09:41.680 --> 09:46.800]  space and a data utilization space that's very different than that which we envisioned 20 years
[09:46.800 --> 09:54.000]  ago, to be honest. And I think we're at a place where the EULA, the agreements you sort of
[09:54.000 --> 10:02.940]  nonchalantly sign off on as you use different software solutions is probably becoming less
[10:02.940 --> 10:09.020]  and less adequate for making sure that people are fully informed about how their information
[10:09.020 --> 10:14.840]  is going to be used. So you asked, you know, what's FDA doing? So FDA doesn't really hold,
[10:14.840 --> 10:20.620]  or under rare circumstances, do we hold identifiable patient health information.
[10:20.620 --> 10:26.600]  And really, we work under the context of the law, as you can imagine, and that's really not our focus.
[10:27.040 --> 10:34.100]  So we work in that way. But we are also, though, and I am very much a part of a social conversation
[10:34.660 --> 10:41.440]  that's really, you know, asking, what does this look like now and into the future? And I think
[10:41.440 --> 10:48.080]  that as we see these different uses of information, as we also see the different challenges
[10:48.080 --> 10:55.340]  of how it can be misused, it's forcing us as a society to ask what is and is not okay. Right now,
[10:55.340 --> 11:01.140]  it's largely in the hands of tech companies that we're sort of all these stories are playing out,
[11:01.140 --> 11:06.300]  likely needs to be in the hands of all the different people who really are the core to
[11:06.300 --> 11:12.580]  not only the conversation, but the data. Exactly, exactly. That's a really good point.
[11:12.580 --> 11:17.760]  Thank you for that. Now, with staying with the tech space, and in terms of cybersecurity,
[11:17.760 --> 11:22.260]  now you have with the advent of the smartphone since 2007, many of the different applications
[11:22.260 --> 11:27.960]  of how we live and interact with life are now onto this little rectangular device that we have
[11:27.960 --> 11:32.220]  in our hands. And that would also include from a health perspective, insulin pumps,
[11:32.220 --> 11:37.620]  and even glucose monitors, that we can now see the actual overall results of what's happening
[11:37.620 --> 11:43.240]  inside our bodies on our phones. Now, with many different news articles in the last year,
[11:43.240 --> 11:48.180]  really coming out that these devices could be hacked into from a cybersecurity perspective,
[11:48.180 --> 11:54.180]  what has the FDA done to take safety steps and precautions to ensure that these devices meet the
[11:54.180 --> 11:58.660]  minimum criteria to ensure patient safety, and this would not happen again in the future,
[11:58.660 --> 12:06.200]  or at least minimize it to some degree? So as FDA, this is a huge area of concern for us.
[12:06.200 --> 12:14.520]  And certainly has been a core focus of our devices center, CDRH. And I commend them,
[12:14.520 --> 12:19.420]  but I also commend the entire community for focusing on this. And that's been done both
[12:19.420 --> 12:24.560]  through public-private partnerships, as well as specifically through work done at FDA,
[12:24.560 --> 12:31.320]  where we worry about really the development of more secure devices going forward, but also
[12:31.320 --> 12:37.880]  the challenge of legacy devices that still exist. For example, the insulin pump that was around
[12:37.880 --> 12:48.020]  since many years ago that may now have a security challenge because those have not been fully
[12:48.020 --> 12:55.360]  patched. And as FDA, one of the things that we've done is build partnerships. And an example of
[12:55.360 --> 13:03.060]  those partnerships is with actually DEFCON and the biohacking community. And when I arrived at FDA
[13:03.060 --> 13:13.980]  about 18 months ago, I was pleasantly surprised to learn that not only were we excited attendees
[13:13.980 --> 13:19.640]  of DEFCON, that we also participated in the biohacking community and had been doing so
[13:19.640 --> 13:27.180]  since 2014, I believe. And that in 2019, we even developed the We Heart Hackers initiative really
[13:27.640 --> 13:33.620]  as a part of our partnership with the white hacking community. And the interesting thing
[13:33.620 --> 13:41.220]  to me about this work that I've at least learned about is that there have been a number of
[13:41.940 --> 13:48.000]  companies participating, I think over 40 different devices that have been attempted
[13:48.000 --> 13:54.600]  to be hacked into and otherwise patched. And really has actually led to a community-based effort
[13:54.600 --> 14:01.180]  to start to resolve problems that could otherwise hurt patients if they don't get resolved. And so
[14:01.180 --> 14:07.340]  to me, this is an example of how the FDA has tried to be forward-leaning into this space. And instead
[14:07.340 --> 14:12.820]  of just writing guidances and saying thou shall or thou shalt, but actually trying to figure out
[14:12.820 --> 14:19.760]  how we will fix together this particular space. That's amazing. That's really good to hear.
[14:20.200 --> 14:25.940]  That really brings us to the end of our discussion today. Maybe some last, I guess,
[14:25.940 --> 14:31.160]  parting words for you, Amy, if you want to share with the audience today in terms of what you would
[14:31.160 --> 14:35.740]  tell the hacking community and the attendees of this overall conference and what to do and how
[14:35.740 --> 14:39.880]  best to contribute data so they can, I guess, better not just devices, but really the overall
[14:39.880 --> 14:45.680]  experience for those that use those devices. Yeah, you know, I've been thinking a lot about
[14:47.240 --> 14:54.120]  the realities of real-world data, how important I think it's going to be for COVID-19 and how I
[14:54.120 --> 15:00.940]  think that this sets a template for how we may also use real-world data and real-world evidence
[15:00.940 --> 15:08.140]  in the future. And then that quickly ports me over to the questions around cybersecurity and
[15:08.140 --> 15:13.580]  hacking. And why do these two come together? Because if our data sets and our real-world
[15:13.580 --> 15:19.160]  data sets are important for health in the way that helps us understand not only natural history
[15:19.160 --> 15:25.820]  disease, but also what treatments are working or downstream safety events of treatments or vaccines,
[15:25.820 --> 15:33.040]  then those data and the safety of the data themselves and our ability to have confidence
[15:33.040 --> 15:37.400]  that they haven't been tampered with, that the devices that are generating those data haven't
[15:37.400 --> 15:44.140]  been tampered with, right, is also a critical task. And so to the white hat hacking community,
[15:44.140 --> 15:50.800]  I ask us to think about how do we continue to keep our real-world data sources safe because
[15:50.800 --> 15:55.720]  those data sources are going to be important for actually our overall public health and safety in
[15:55.720 --> 15:59.800]  the future. And I think that that's going to be an important area of inquiry and questioning
[15:59.800 --> 16:05.320]  that really hasn't gotten enough attention yet. Thank you for that. That's really helpful. And
[16:05.320 --> 16:08.600]  it's nice to know that this partnership is going to continue and only probably blossom in the
[16:08.600 --> 16:14.140]  future to get even more insights that you can possibly get to, I guess, from now on. With that,
[16:14.140 --> 16:21.180]  that brings us to the end of this fireside chat session. So thank you so much for attending and
[16:21.180 --> 16:23.680]  have a great conference, everyone. Thank you.
